critical9.8Public exploit code
CVE-2019-18818
Strapi allows unauthenticated attacker to reset admin password without valid reset token
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)2022-02-08 · webapps · nodejs
- Strapi 3.0.0-beta - Set Password (Unauthenticated)2021-08-30 · webapps · multiple
Impact
Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. ## Recommendation Upgrade to version 3.0.0-beta.17.5 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | strapi | <= 3.0.0-beta.17.4 | 3.0.0-beta.17.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strapi | Strapi | through 1.6.4 Version 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html
- http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html
- https://github.com/strapi/strapi/pull/4443
- https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5
- https://www.npmjs.com/advisories/1311
- https://github.com/advisories/GHSA-6xc2-mj39-q599
- https://nvd.nist.gov/vuln/detail/CVE-2019-18818
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18818